CSP Intergration not working

Support
, , ,
1

Hello Netlify Support,

I am encountering an issue with my Next.js application hosted on a Pro account on Netlify, where I am unable to integrate Content Security Policy (CSP) correctly. Despite configuring the CSP using the plugin in the netlify.toml file and/or enabling integration from the Netlify site settings, the nonce attribute is not being applied to my scripts.

Here are the steps I’ve taken and the issues I’ve encountered:

  1. Configured CSP Plugin: I have added the necessary configuration for the CSP plugin in my netlify.toml file, expecting it to automatically set nonces for my scripts.
  2. Enabled Integration from Netlify Site: I have also tried enabling CSP integration directly from my Netlify site dashboard, assuming it would manage the nonces.
  3. No Nonce Set: Despite these configurations, there is no nonce set to the scripts when I inspect the deployed site, and it behaves as if CSP is not enabled at all.
  4. No Logs in Functions: The CSP settings appear in the Functions section of my Netlify dashboard, but there are no logs or errors indicating what might be going wrong.

I am looking for guidance on why the nonce is not being set and how to resolve this issue. Any insights or suggestions would be greatly appreciated.

Thank you for your assistance.

2

Hi there,

Thanks for reaching out and apologies for the hassle! When you have a chance, can you confirm whether each of these criteria are currently met? Namely:

  • The request method is GET
  • The content-type response header starts with text/html
  • The path of the request is satisfied by the path config option, and not included in the excludedPath config option

Looking forward to hearing from you!